Live › vulnerability › CVE-2026-62057
The cf7-styler-for-divi WordPress plugin does not neutralize script-related HTML tags in a web page, so injected code can run in visitors' browsers. An attacker can use this to run scripts in the context of the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the cf7-styler-for-divi plugin for Contact Form 7 styling with Divi, at version 4.1.0 or earlier. Sites without this plugin are not affected. The sources do not say whether an account is needed to exploit it.
No product ranges from the sources yet.
cf7-styler-for-divi plugin is installed and its version, e.g. in the WordPress admin under Plugins4.1.0 if the plugin is present4.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-62057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.